CVE-2024-38863

What it actually does

CSRF tokens are exposed in query parameters on specific requests, allowing token leakage via logs, referrers, or browser history.

Why it matters to the business

Attackers can obtain valid tokens to craft convincing phishing lures that bypass token protections, increasing risk of account compromise in monitored environments.

How an attack unfolds

An attacker identifies a vulnerable Checkmk endpoint that includes the CSRF token in the URL query string, then tricks an authenticated user into visiting a crafted link or visiting a page that triggers the request, capturing the token from the resulting URL exposure to enable targeted follow-on phishing.

How to fix it

Upgrade Checkmk to version 2.3.0p18 or later, 2.2.0p35 or later, or 2.1.0p48 or later. Review web server and application logs for any prior token exposure and rotate affected tokens where feasible.

How to confirm the fix worked

Confirm the installed version meets or exceeds the fixed releases listed above. Test sample requests that previously included tokens in query strings to verify they no longer do so. Scan logs and proxy captures for any historical instances of token leakage.

Typical attack path

1. Reconnaissance to locate exposed Checkmk instances and identify requests that leak tokens in query parameters
2. Crafting a malicious link or page that causes an authenticated user to trigger the leaking request
3. Capturing the exposed CSRF token from browser history, server logs, or referrer headers
4. Using the stolen token to create phishing messages that appear legitimate to the target
5. Executing actions via the token to achieve account takeover or further persistence

How to detect it

Search web server access logs, proxy logs, and application logs for requests containing CSRF tokens embedded in query strings. Monitor for unusual referrer headers or external links that trigger Checkmk endpoints known to leak tokens.

What your security team should do

• Prioritize patching all Checkmk instances to the fixed versions immediately due to the direct facilitation of phishing
• Audit web access and application logs for any URLs containing CSRF tokens in query parameters
• Implement URL parameter filtering or logging redaction to prevent future token exposure
• Educate users on recognizing phishing attempts that may leverage stolen tokens